Bump github.com/square/go-jose from 2.1.6+incompatible to 2.5.1+incompatible

[dependabot]

Bumps github.com/square/go-jose from 2.1.6+incompatible to 2.5.1+incompatible.

Release notes

Sourced from github.com/square/go-jose's releases.

Version 2.5.1

Bug Fixes

• Fix parsing and validation of x5t and x5t#S256 headers for JWK (h/t @mangas) (#305).

Version 2.5.0

New Features

• Add support for x5u, x5t, and x5t#S256 headers for JWK (#242).
• Add support for RFC 7638 canonical kid for JWK (#269).

Bug Fixes

• Add error checking in jose-util to avoid nil referencing (#250).
• Documentation improvements (#274, #280, #289).

Version 2.4.1

Bug Fixes

• Fixes a bug introduced in v2.4.0 that could cause a panic on invalid inputs (#282).
• Improves performance of parsing payloads with a lot of whitespace (#279).

Version 2.4.0

New Features

• Add support for the b64 header parameter (#230).
• Add functions to handle detached signatures (#234).
• Expose an interface for opaque key encryption/decryption (#261, #257).

Bug Fixes

• Fixes a issue with ECDSA on P-521, whereby the generated shared secret derived for encryption was computed incorrectly (#267, #245).
• Fixes salt length for new RSA-PSS messages to be equal to the hash length, as required by RFC 3447 (#232).
• Don't include the kid header in a JWT if the key id is an empty string (#227).

Version 2.3.1

Fixes a bug in the serialization of ED25519 keys to JWK (JSON), where X/D values ended up being switched for one another in the serialized output (see #224). Reading a serialized private key would also end up switching the X/D values for another, so keys that were serialized/deserialized with old versions of go-jose would work fine (values should end up in the correct place again). However, sharing a private key with another library would have caused problems. If you have private keys that were previously serialized to JWK using this library, the X/D values will be incorrect and will need to be switched in the JSON serialization before the key can be deserialized with an updated version of go-jose.

Version 2.3.0

New Features

• Add support for unwrapping JSON Web Key Set in the jwt sub-package. This means the key passed to Claims or Decrypt can now be a set of keys (of type *jose.JSONWebKeySet), and the key will be selected automatically based on the key id in the header of the token.

Bug Fixes

• Improves handling of exp, iat and nbf claims. This means proper handling for zero dates (#214), don't error if optional exp and nbf claims are missing from the token (#220), and perform an extra check on iat if it is present (#217). Note that expiration in tokens is optional per standard, if you want to require expiration or other claims to be absolutely present in a token be sure to check the claim is present.

Note this release also drops support for Go 1.5 and Go 1.6, we now require Go 1.7 or later.

Version 2.2.2

Exports the random reader used for internal randomness to make deterministic tests possible (#212). This allows consumers of the library to add tests that can compare known inputs/outputs deterministically.

Version 2.2.1

This release adds stricter checks (#210) for handling JWKs with elliptic keys. As per RFC 7518, Section 6.2.1.2 to 6.2.2.1 the length of this octet strings for X/Y/D values in JWKs MUST be the full size of a coordinate for the curve specified in the "crv" parameter. As a result, invalid JWKs that were previously accepted (e.g. a JWK where the padding was missing on X/Y coordinates) will now be rejected when parsing them.

Version 2.2.0

Bug Fixes

• Check that key size when matches cipher for DIRECT encryption mode (issue #204, fix in #205)

... (truncated)

Commits

• 3a5ee09 Merge pull request #305 from square/mbyczkowski/v2-304-backport
• 1323f1f Fix decoding x5t parameters (#304)
• 2204b3e Merge pull request #291 from square/mbyczkowski/v2-cherry-picks
• 18864eb Document iat claim for jwt.Expected
• 5ac6eba Fix typo in claims.go
• 0af3954 add comments documenting cram is used for jose-util testing
• 5c5751a Support RFC 7638 canonical kid for JWK (#269)
• 6ed2107 added error checking avoid nil referencing when error occurs
• 9d1ab6c Support x5u, x5t, and x5t#S256 headers.
• 4ef0f1b Merge pull request #282 from square/cs/jws-panic
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)